private static DateTime?GetUsersLogonTimestamp(DprCurrentUsers user) { if (string.IsNullOrEmpty(user.UserName) || string.IsNullOrEmpty(user.Domain) || Win32.WellKnownSids.ContainsKey(user.Sid)) { return(null); } WmiHelpers.ForEachWithScope(user.ComputerName, @"SELECT * FROM Win32_LogonSession", (obj, scope) => { try { var roq = new RelatedObjectQuery(string.Format(@"associators of {{Win32_LogonSession.LogonId='{0}'}} WHERE AssocClass = Win32_LoggedOnUser", WmiHelpers.GetString(obj, @"LogonId"))); using (var searcher = new ManagementObjectSearcher(scope, roq)) { foreach (var mobObj in searcher.Get( )) { Helpers.AssertNotNull(mobObj, @"WMI Error, null value returned."); var mob = (ManagementObject)mobObj; var name = WmiHelpers.GetString(mob, @"Name"); var domain = WmiHelpers.GetString(mob, @"Domain"); if (!name.Equals(user.UserName) || !domain.Equals(user.Domain)) { continue; } user.LastLogon = WmiHelpers.GetNullableDate(obj, @"StartTime"); return(false); // Found, stop loop } } } catch (ManagementException ex) { GlobalLogging.WriteLine(Logging.LogSeverity.Error, @"Error finding last logon on {0} for {1}\{2}\n{3}", user.ComputerName, user.Domain, user.UserName, ex.Message); } return(true); }, false, false); return(user.LastLogon); }